Writing Information Security Policies

What the Policy Reviews Should Include

The first three chapters of this book set the groundwork for creating these policies. In those chapters, I also suggest that this type of support should go into the review process. One of the reasons I said this is to leverage much of the information that was collected during the authoring process. Over the course of time, operations and the procedures created to support these policies will refine that research and create additional information that should provide additional input to the review process.

One of the most important elements to include in the review is the information gained from a risk assessment or audit. As I discussed in Chapter 1, “What Information Security Policies Are,” the risk assessment ...